Security and access control
What follows is what this product actually enforces. There is no certification claim on this page and no number that is not measured, because a security page that overstates is worse than one that says less.
What is enforced
Separation between accounts
Workspaces are isolated on the server. A request for another account's data is answered as not found before any permission check runs, which is the order that makes the isolation hold even if a policy is wrong.
Roles, enforced server-side
Administrator, agent and optional custom permission sets are checked on the server for every request. Hiding a button is not access control and is not relied on here.
Encrypted in transit, and credentials at rest
Traffic is HTTPS with HSTS. Channel credentials and store keys are encrypted at rest with application-level encryption, and they are never written into the audit trail.
An audit trail that cannot be switched off
Configuration changes and sign-ins are recorded, by a mechanism the audited party cannot disable, and retained for 365 days.
IP addresses coarsened
Where an address is recorded it is reduced to a network rather than kept in full, and it is never geolocated.
A verified backup before every deployment
A database backup is taken and checked as readable before each deployment, the last fourteen are kept, and the rollback procedure is written down rather than improvised.
Worth knowing
No certification is claimed: there is no SOC 2, ISO 27001, PCI or HIPAA artefact for this product, and this page makes no data-residency or hosting-region claim. Encryption at rest covers credentials and store keys, not message bodies, contacts or attachments. The audit trail is an operator-side control and is not exposed as a customer-browsable log, and it records configuration changes and sign-ins — not every action an agent takes.